CCSP Practice Test 11 — 15 Questions

Question 1

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config rule + AWS Lambda auto-remediation. AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Answer

Amazon GuardDuty + AWS Step Functions

Answer

AWS CloudTrail + Amazon SNS

Answer

AWS Trusted Advisor + AWS Systems Manager

Question 2

A company uses a cloud-based database that contains personally identifiable information (PII). They need to allow developers to run queries against the database for testing purposes without exposing actual PII. Which technique should they use?

Accepted Answer

Apply dynamic data masking to the PII columns. Dynamic data masking (DDM) allows the database to return masked PII to developers in real time without altering the underlying stored data. This technique applies masking rules at query runtime, so developers can run functional tests against production-like data while sensitive values are obfuscated. It avoids the need for separate sanitized copies and preserves referential integrity for testing.

Answer

Encrypt the PII fields at rest

Answer

Grant developers direct access to a copy of the production data

Answer

Tokenize the PII fields with a one-way hash

Question 3

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.. A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.

Answer

Use shared API keys embedded in each service's configuration.

Answer

Implement TLS termination at the load balancer with internal certificates.

Answer

Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.

Question 4

A company is migrating its customer database to a cloud object storage service. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that the company retains exclusive control over the encryption keys. Which solution BEST meets these requirements?

Accepted Answer

Use client-side encryption with customer-managed keys stored on-premises.. Client-side encryption with customer-managed keys stored on-premises ensures that the encryption keys never leave the company's control, and the data is encrypted before it is uploaded to the cloud object storage service. This satisfies both the requirement for encryption at rest and exclusive key control, as the cloud provider never has access to the plaintext keys or the ability to decrypt the data.

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Answer

Use SSL/TLS encryption for data in transit only.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Question 5

Which THREE of the following are common challenges in securing serverless applications?

Accepted Answer

Insecure handling of event source inputs. Option B is correct because serverless functions are triggered by diverse event sources (API Gateway, S3, SNS, SQS, etc.), and failing to validate or sanitize these inputs exposes functions to injection and event-injection attacks. Option C is correct because serverless deployments rely heavily on third-party packages and runtime dependencies, so vulnerable or outdated libraries become a primary risk since providers do not patch application code. Option D is correct because decomposing an application into many small functions multiplies entry points and triggers, enlarging the attack surface that must be individually secured and monitored. Option A is not a distinguishing serverless challenge since the provider manages the kernel and OS, removing that control burden from the customer. Option E is not applicable because serverless architectures are inherently stateless and typically rely on security groups, IAM, and WAF rather than stateful firewall rules.

Answer

Lack of control over the underlying kernel and OS

Answer

Difficulty in applying stateful firewall rules

Question 6

A DevOps team is deploying an application that will store encryption keys in a cloud KMS. The security policy requires that keys be stored in a hardware security module (HSM) and that key material never leaves the HSM boundary. Which key management option should they choose?

Accepted Answer

Cloud KMS with HSM-backed key storage. Cloud KMS with HSM-backed key storage ensures that key material is generated and stored inside a FIPS 140-2 Level 3 validated HSM, and cryptographic operations occur within the HSM boundary. This satisfies the requirement that keys be stored in an HSM and that key material never leaves the HSM.

Answer

Customer-managed encryption keys (CMEK) with software-backed storage

Answer

Hold your own key (HYOK) with on-premises HSM

Answer

Bring your own key (BYOK) with key import to cloud KMS

Question 7

An API endpoint returns user profile details including email, phone, and address. The response includes fields that are not needed for the client application. Which OWASP API Security risk does this represent?

Accepted Answer

Excessive Data Exposure. Excessive Data Exposure occurs when an API returns more data than the client needs, often relying on the client to filter sensitive fields. In this case, the API returns email, phone, and address even though the client application does not require them, exposing sensitive user information. This is a top OWASP API Security risk because it can lead to privacy breaches and data leakage.

Answer

Mass Assignment

Answer

Broken Object Level Authorization

Answer

Lack of Rate Limiting

Question 8

A company subject to PCI DSS is considering a cloud provider to process credit card transactions. What must the cloud provider present to demonstrate compliance with PCI DSS?

Accepted Answer

A PCI DSS Attestation of Compliance (AOC) from a QSA. PCI DSS compliance for a cloud provider is demonstrated through a PCI DSS Attestation of Compliance (AOC) validated by a Qualified Security Assessor (QSA) or, for service providers, a Report on Compliance (ROC). The AOC is the formal document that attests the provider meets the 12 PCI DSS requirements for the services in scope. Customers rely on the provider's AOC to inherit controls and reduce their own assessment scope.

Answer

A CSA STAR Level 1 self-assessment

Answer

A SOC 2 Type II report

Answer

An ISO 27001 certificate

Question 9

A cloud application allows users to upload profile pictures that are stored in Azure Blob Storage. Which vulnerability is most likely if the application does not validate the content type or size of uploaded files?

Accepted Answer

Unrestricted File Upload. Without validation, an attacker could upload a malicious file (e.g., a web shell) that could be executed on the server, leading to remote code execution.

Answer

Server-Side Request Forgery (SSRF)

Answer

Mass Assignment

Answer

Broken Object Level Authorization (BOLA)

Question 10

During litigation, a company receives a legal hold notice for electronically stored information (ESI) in a cloud environment. The cloud provider's standard service agreement includes a clause that automatically deletes data 30 days after termination of service. What should the company do to ensure compliance?

Accepted Answer

Notify the provider to preserve the data. A legal hold notice imposes a duty to preserve relevant ESI. The company must notify the cloud provider to suspend any automatic deletion policies, such as the 30-day post-termination deletion clause, to ensure data is preserved in accordance with eDiscovery obligations under FRCP Rule 37(e) or similar regulations.

Answer

Ignore the legal hold notice

Answer

Download all data immediately

Answer

Terminate the account to stop further processing

Question 11

Your company, a global e-commerce platform, operates on a multi-cloud environment with workloads in AWS and Azure. You are the lead cloud architect. The platform experiences peak traffic during promotional events, with traffic spikes up to 10x normal. The application is composed of microservices running in containers orchestrated by Kubernetes on both clouds. Each cloud provider's Kubernetes cluster uses cluster autoscaler and horizontal pod autoscaler. Recently, during a flash sale, the AWS cluster failed to scale adequately, causing latency spikes and timeouts. AWS support indicated that the cluster hit a service quota limit for EC2 instances. You need to prevent this from recurring. You have the following options: A) Implement a multi-region deployment on AWS to distribute load. B) Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first. C) Migrate all workloads to Azure to simplify management. D) Use a global load balancer to route traffic to the cloud with the most available capacity. Which option is the best course of action?

Accepted Answer

Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first.. The root cause is a hard AWS service quota for EC2 instances, which prevents the cluster autoscaler from launching new nodes. Requesting a quota increase removes this bottleneck, while pod priority classes ensure that critical microservices are scheduled first when resources are constrained, preventing latency spikes during flash sales.

Answer

Implement a multi-region deployment on AWS to distribute load.

Answer

Migrate all workloads to Azure to simplify management.

Answer

Use a global load balancer to route traffic to the cloud with the most available capacity.

Question 12

A cloud customer is subject to eDiscovery requirements in a lawsuit. The data resides in a cloud storage service that uses encryption. What is the primary challenge in collecting this data in a forensically sound manner?

Accepted Answer

Ensuring the integrity and chain of custody when data is collected via API or provider tools rather than physical seizure. In cloud eDiscovery, data is collected via APIs or provider-native tools rather than by seizing physical media, so the primary forensic challenge is preserving integrity and demonstrating an unbroken chain of custody. Unlike physical seizure where a disk can be hashed and sealed, API-based collection must be logged, hashed, and authenticated to withstand legal scrutiny. The encryption itself is not the main obstacle if the customer holds the keys; the procedural integrity of the collection is what courts and opposing counsel will challenge.

Answer

Obtaining a search warrant for data stored in the cloud

Answer

Decrypting the data without the encryption keys

Answer

Identifying the specific geographic location of the data

Question 13

A healthcare organization recently migrated a patient records management application from on-premises infrastructure to a cloud environment using Infrastructure as a Service (IaaS). The application was originally designed as a monolithic workload running on bare-metal servers. After migration, the application is deployed on a fleet of virtual machines (VMs) of the same instance type. The organization is using a combination of Reserved Instances for baseline capacity and On-Demand instances to handle spikes. However, two months after the migration, the cloud bill is 40% higher than the estimated on-premises total cost of ownership. Additionally, performance reports indicate that the application experiences inconsistent latency and occasional timeouts during peak hours. The operations team has confirmed that the application code has not changed, and the cloud provider's infrastructure is healthy. There is no issue with network bandwidth or storage I/O. The team is considering several options to address both cost and performance issues. What should the team do first?

Accepted Answer

Perform a rightsizing analysis of the current VM usage and adjust instance types accordingly.. The first step should be to perform a rightsizing analysis of the current VM usage. The application was migrated from bare-metal servers to VMs of the same instance type, which may not be optimal. Rightsizing identifies over-provisioned or under-provisioned resources, addressing both cost (by reducing waste) and performance (by ensuring adequate resources). This is a foundational step before considering other optimizations.

Answer

Migrate the application to serverless compute to eliminate the need to manage VMs.

Answer

Consolidate the workload into fewer, larger instances to reduce overhead and licensing costs.

Answer

Replace On-Demand instances with Spot Instances to reduce costs during spikes.

Question 14

What is the primary purpose of cloud security posture management (CSPM) tools?

Accepted Answer

To assess and improve the security configuration of cloud resources against benchmarks.. CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Answer

To provide a centralized log storage solution.

Answer

To detect real-time threats like malware and intrusions.

Answer

To manage user identities and access permissions.

Question 15

Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?

Accepted Answer

Platform as a Service (PaaS). NIST SP 800-145 defines PaaS as the model where the consumer deploys applications onto cloud infrastructure but does not manage the underlying network, servers, operating systems, or storage. The consumer controls the deployed applications and possibly application-hosting environment configurations — exactly matching the question's description. This is the canonical PaaS definition.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)